HoneyLabs

UDP traffic

Datagrams matching asn:57043 sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

4

Datagrams

1

Source addresses

1

Networks

1

Countries

4

Destination ports

Traffic by type

Unrecognised

4 datagrams from 1 source

Datagrams no decoder recognised. Their first bytes are kept.

Latest Unrecognised datagram, to 5353/udp

·.ww]·Ql·i~<_>:·a'P·s·PeR|w"(`v-pm$N·v:·_9W>w· K

payload bytes
00000000  04 2e 77 77 5d 14 51 6c  19 69 7e 3c 5f 3e 3a 18  |..ww].Ql.i~<_>:.|
00000010  61 27 50 0b 73 1e 50 65  52 7c 77 22 28 60 76 2d  |a'P.s.PeR|w"(`v-|
00000020  70 6d 24 4e 01 76 3a 1a  5f 39 57 3e 77 11 0a 4b  |pm$N.v:._9W>w..K|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

ServicePortDatagramsSourcesFactor
mDNS5353/udp112 to 10
SSDP1900/udp1130.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

Networks

Countries

Source addresses (unverified)

AddressNetworkCcSendsDatagramsLast seen (UTC)
141.11.209.245AS57043 Hostkey B.v.NLUnrecognised42026-10-11 13:28

Latest datagrams